Request for Information - Multi-X Security (MXS) Platform Operations and Maintenance

Request for Information Multi-X Security (MXS) Platform Operations and Maintenance 15 October 2026 1.0 Description The Air Force Life Cycle Management Center, in support of the Advanced Technology Branch (AFLCMC/HNJT), is seeking information from interested companies with the capability to provide Operations and Maintenance, and continuous modernization of the Multi-X Security (MXS) Platform. 2.0 Background Between 2019 and 2026, the Advanced Technology program office developed the MXS (pronounced "Maxis") Platform as a modern security model, data model, reference architecture, and reference implementation, based on open standards and protocols to support software development and secure information sharing at multiple security levels. MXS' goal is to enable Protection Level 3 (PL3) software solution development by third-party developers within security-constrained environments, as typically employed by communities working with Special Access Programs (SAPs). 3.0 Description of Requirements 3.1 Scope & Operating Environment: AFLCMC/HNJT requires information on industry capabilities to operate, maintain, and continuously enhance a multi-tenant, cloud-native platform supporting Air Force and mission-partner applications. The platform operates across multiple security enclaves, including Unclassified, Secret//Special Access Required (SAR), Top Secret//SAR, and Top Secret//Sensitive Compartmented Information (SCI)//SAR cloud environments. 3.2 Platform Operations, Maintenance & DevSecOps: Prospective contractors are expected to provide proactive 24/7/365 system availability, platform administration, and lifecycle sustainment across all designated cloud environments. Core focus areas include: 3.2.1 Cloud-Native Infrastructure: Operating and maintaining containerized environments (e.g., Kubernetes), service meshes, Application Programming Interface (API) gateways, and Infrastructure-as-Code (IaC) baselines. 3.2.2 DevSecOps Toolchain: Sustaining an automated continuous integration/continuous delivery (CI/CD) pipeline that enables secure cross-domain software progression. 3.2.3 Telemetry & Resource Monitoring: Providing automated, granular visibility into platform health, microservice performance, compute/storage utilization, and licensing. 3.2.4 Enterprise ICAM & Certificate Services: operate and maintain enterprise identity management infrastructure across multiple tenants. 3.2.5 Managed Database Services, Registered Queries & API Mediation: Provision, sustain, and optimize managed database services across cloud environments, engineer registered and parameterized queries for controlled data access and governance, and diagnose latency or throughput bottlenecks. 3.3 Continuous Platform Evolution: Delivering agile enhancements, feature updates, and technical debt remediation in alignment with government-prioritized backlogs. 3.4 Tenant Enablement & Multi-Tier Support: To support diverse tenant software programs, the platform requires integrated customer enablement services. 3.4.1 Tenant Onboarding and Offboarding: Assisting tenant developer teams with architectural guidance, common control inheritance, and standardized integration toolkits. 3.4.2 Service Desk Operations: Operating a tiered technical service desk (Tier 1-3) providing incident management, troubleshooting, and user assistance across all classification levels. 3.5 Cybersecurity & Continuous Authorization: The platform must maintain a rigorous cybersecurity posture compliant with DoD, Intelligence Community, and SAP directives. 3.5.1 Sustaining existing Risk Management Framework (RMF) Authorizations to Operate (ATOs). 3.5.2 Executing Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST), container vulnerability assessments, dependency assessments (Software Bill of Materials (SBOM), Vulnerability Exploitability eXchange (VeX), etc.), and rapid vulnerability remediation. 3.5.3 Generating and maintaining RMF bodies of evidence and security documentation to maintain inheritance relationships for hosted software and systems. 3.6 Potential Security, Facility, and Personnel Requirements. The Government is conducting market research regarding the availability, timing, and feasibility of contractor personnel clearances, secure facilities, and cybersecurity qualifications that may be required for a future acquisition. The requirements of any future solicitation, including timing and acceptability of facilities, will be established only in that solicitation. 3.6.1 Personnel Clearances: Contractor personnel must possess active Top Secret clearances and applicable DoD 8140 baseline certifications at the time of contract award, with the ability to obtain SCI and SAP access within 30 days of contract award 3.6.2 Secure Facilities: Within 30 days of contract award, the Contractor shall possess and maintain accredited Sensitive Compartmented Information Facility (SCIFs)/Special Access Program Facility (SAPFs), as required to perform the classified development and operational activities under this contract. Each facility shall maintain current written accreditation by the cognizant accrediting authority and comply with applicable requirements of ICD 705, DoDM 5105.21, Volume 2, and DoDM 5205.07. 4.0 Specific Areas of Interest 4.1 Corporate Overview & Business Classification 4.1.1 Entity Identification: State your company name, Commercial and Government Entity (CAGE) code, and business size/socioeconomic status under the designated North American Industry Classification System (NAICS) code. 4.1.2 Contract Vehicles: List the relevant Government-Wide Acquisition Contracts (GWACs), Multiple Award Schedules (e.g., GSA MAS, NASA SEWP, OASIS+), or agency vehicles your organization currently holds. 4.2 Experience & Technical Approach 4.2.1 Relevant Past Performance: Provide up to three (3) examples (within the past 5 years) demonstrating prime or major subcontractor experience operating multi-tenant cloud platforms of comparable scope, complexity, and classification (including Amazon Web Services (AWS)/Azure Secret, Top Secret, or SAP enclaves). 4.2.2 Platform Management & DevSecOps: Describe your experience managing cloud-native infrastructure (e.g., Kubernetes, service mesh, Infrastructure as Code (IaC)) and sustaining multi-fabric DevSecOps pipelines across air-gapped or cross-domain environments. 4.2.3 Platform Software Development Kits (SDKs) & Toolkits: Summarize your experience developing and sustaining SDKs, shared libraries, and developer modules to accelerate tenant application delivery. 4.2.4 Enterprise Identity, Credential, and Access Management (ICAM) & Certificate Services: Describe your experience deploying and sustaining enterprise and external Certificate Authorities (CAs) across multi-tenant and air-gapped environments, including certificate validation and revocation infrastructure (e.g., Online Certificate Status Protocol (OCSP) responders, Certificate Revocation List (CRL) distribution points). 4.2.5 Managed Database Services, Registered Queries & API Mediation: Describe your experience provisioning, optimizing, and troubleshooting cloud-managed database services, including engineering registered and parameterized queries for controlled access and governance. Detail your experience developing middleware, abstraction layers, or gateway adapters for protocol bridging, query translation, and data transformation across disparate APIs. 4.2.6 Protection Level 3 (PL-3) Multi-Level Access Control & Attribute-Based Authorization: Describe your experience engineering and operating applications within PL3 SAR environments to restrict data access to users' explicit clearance and compartment authorizations. Detail your approach to synchronizing identity attributes from Authoritative Data Sources (ADS) and implementing, enforcing, and auditing Role-Based Access Control (RBAC), Mandatory Access Control (MAC), and Attribute-Based Access Control (ABAC) policies using Policy ...